OpenAI model helped identify a vulnerability in PHP — The Japan Times

In Washington, United States, companies and government agencies rushed last week to install fixes for two critical vulnerabilities in PHP, a programming language that powers a significant share of websites worldwide. One of the vulnerabilities, which could have been exploited by hackers, was identified with the help of a powerful OpenAI model, The Japan Times reports.

AI may speed up the search for flaws

Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator under President Barack Obama, said that the development of advanced artificial intelligence models could usher in a rather chaotic period. In his view, AI's ability to find flaws in software quickly and at scale will lead to a flood of new vulnerabilities.

Daniel linked this to accumulated technical debt. According to him, organizations often keep old software for as long as possible without factoring the risks associated with it into the cost of using it. Such costs remain implicit until an event such as the discovery of critical flaws occurs.

More current news is available on the UA.News Telegram channel Telegram.

Patches will have to be installed faster

Daniel believes that organizations should be prepared to update software, keep it current and deploy patches quickly. This particularly applies to smaller entities with limited in-house technical resources: they need to speed up the installation of updates from vendors.

According to him, historically attackers have exploited about 5–6% of known vulnerabilities, and there are no signs that this figure is increasing. At the same time, the period between the appearance of a technical demonstration of a vulnerability and its use in attack toolkits has shrunk from one or two months to hours or days.

Daniel also noted that AI finds many false issues or issues in software that does not have internet access. Therefore, organizations need to improve their systems for verifying and prioritizing identified vulnerabilities. In the future, such models could be used even before software is deployed to release products with fewer security flaws.